VYPR
← All advisories
High severity8.8NVD Advisory· Published May 16, 2017· Updated May 13, 2026

CVE-2017-7661

CVE-2017-7661

Description

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf.fediz:fediz-spring2Maven
>= 1.3.0, < 1.3.21.3.2
org.apache.cxf.fediz:fediz-spring2Maven
< 1.2.41.2.4
org.apache.cxf.fediz:fediz-jetty9Maven
< 1.3.21.3.2
org.apache.cxf.fediz:fediz-jetty8Maven
< 1.3.21.3.2

Affected products

4
  • Apache/Cxf Fediz3 versions
    cpe:2.3:a:apache:cxf_fediz:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:cxf_fediz:*:*:*:*:*:*:*:*range: <=1.4.0
    • cpe:2.3:a:apache:cxf_fediz:1.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf_fediz:1.3.2:*:*:*:*:*:*:*
  • Apache Software Foundation/Apache CXF Fedizv5
    Range: prior to 1.4.0, 1.3.2 and 1.2.4.

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

16

News mentions

0

No linked articles in our index yet.